ekyc

Electronic KYC process with uploading ID document using OAuth 2.1 (experimental)
Log | Files | Refs | README | LICENSE

2.architecture.tex (3470B)

      1 \chapter{Architecture}
      2 
      3 \section{Top-level overview}
      4 
      5 \begin{figure}[H]
      6     \centering
      7     \includegraphics[width=0.9\textwidth]{toplevel}
      8     \caption{Top-level project overview}
      9     \label{fig:arch-toplevel}
     10 \end{figure}
     11 
     12 The diagram above illustrates the three primary actors in the project:
     13 \begin{enumerate}
     14     \item \textbf{Customer}: the end user who wishes to deposit liquidity on the GNU Taler Exchange
     15     \item \textbf{GNU Taler Exchange}: the payment service subject to AML, which delegates the eKYC process to the KYCID service
     16     \item \textbf{KYCID}: the web service responsible for executing the eKYC process for GNU Taler Exchange
     17 \end{enumerate}
     18 
     19 \pagebreak
     20 
     21 The following diagram is a model of the project's planned money deposit sequence.
     22 
     23 \begin{figure}[H]
     24     \centering
     25     \includegraphics[width=0.8\textwidth]{toplevel-sequence}
     26     \caption{Top-level project sequence flow}
     27     \label{fig:arch-toplevel-sequence}
     28 \end{figure}
     29 
     30 The following steps are involved in the process:
     31 \begin{enumerate}
     32     \item \textbf{Deposits}: The customer deposits liquidity on a GNU Taler exchange.
     33     \item \textbf{Initiation of eKYC process}: As the exchange is subject to the AML, it initiates a KYC process using the KYCID service (delegation via OAuth2 authorisation flow). The customer's browser is redirected to the KYCID.
     34     \item \textbf{OAuth front channel, eKYC}: comprises a series of round trips between the customer's browser and the KYCID, during which the KYC process is performed. This process requires interaction with the customer, as illustrated in figure.
     35     \item \textbf{OAuth back channel}: Once the KYC process has been completed, the user's browser is redirected to the exchange with an authorisation code that allows it to retrieve an access token from the KYCID. This is the OAuth back channel.
     36     \item \textbf{Retrieve eKYC information}: the exchange can retrieve the information from the eKYC process thanks to the access token previously granted. 
     37     \item \textbf{Release}: once verified, if the exchange criteria are satisfied. It can release the deposits. 
     38 \end{enumerate}
     39 
     40 The process described above is a case study of an OAuth authorisation code flow application for GNU Taler that performs an eKYC procedure to release money.
     41 you can find more details on how OAuth2 works in section \ref{OAuth2-Framework}.
     42 
     43 \section{System architecture}
     44 
     45 \begin{figure}[H]
     46     \centering
     47     \includegraphics[width=0.9\textwidth]{system}
     48     \caption{System architecture}
     49     \label{fig:arch-system}
     50 \end{figure}
     51 
     52 The figure above on the left shows the \textbf{primary actors} in the system (listed below).
     53 \begin{itemize}
     54     \item \textbf{Client}: The client is the service that delegates the KYC process to the system. An example of this is the GNU Taler exchange.
     55     \item \textbf{Customer}: The user whose identity is being verified.
     56 \end{itemize}
     57 
     58 And on the right shows the \textbf{secondary actors} in the system (listed below).
     59 \begin{itemize}
     60     \item \textbf{SMS Provider}: The system must send SMS messages to verify the phone number. \\
     61         Swisscom is the SMS provider via the text messaging product, which allows SMS to be sent via a REST API.
     62     \item \textbf{Mail sending server}: The system must also send an email to verify the address and notify the user. An SMTP server (such as Microsoft Exchange) is required.
     63     \item \textbf{Persistence}: A postgres sql database to store system status.
     64 \end{itemize}